Advanced Shipment Tracking for WooCommerce (<= 3.9) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/advanced-shipment-tracking-for-woocommerce--3.9/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 05:54:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdvanced Shipment Tracking for WooCommerce: SQL injection (CVE-2026-120558)https://feed.craftedsignal.io/briefs/2026-11-woo-shipment-sql-injection/Tue, 03 Nov 2026 05:54:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-woo-shipment-sql-injection/The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to authenticated SQL injection via the tracking_provider parameter, allowing attackers with Shop Manager privileges to exfiltrate database contents.The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL injection in versions up to and including 3.9. The vulnerability exists within the WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() method, where the tracking_provider parameter is improperly concatenated into a SQL query processed by $wpdb->prepare(). Authenticated users with Shop Manager privileges or higher can leverage this to execute unauthorized SQL queries and extract sensitive information from the database.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized database operations, potentially leading to the exfiltration of sensitive information contained within the WordPress database.

Recommendation

  • Update Advanced Shipment Tracking for WooCommerce to the version containing the security patch (expected to be > 3.9).
  • Review Shop Manager role assignments and audit current plugin users for unauthorized account activity.
  • Monitor REST API traffic targeting /wp-json/wc-ast/v3/orders/ for anomalous POST requests containing SQL syntax or characters commonly used in injection attacks.
]]>highadvisorywordpresssql-injectionwebserver